Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

3 clusters · 19 sources · 6 days · First seen 10 days ago · Last updated 4 days ago

ConnectWise Cloud Backup supply chain attack

Overview

A supply chain attack targeting ConnectWise Cloud Backup, formerly known as SkyKick, has compromised numerous Microsoft 365 tenants. Attackers compromised the OAuth application for the service to steal access tokens, allowing unauthorized access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Microsoft confirmed malicious activity involving unauthorized authentication attempts, noting that attackers have been adding credentials for the service principal to compromised environments to maintain persistent access. Cybersecurity firm Huntress reported identifying at least 162 to 173 compromised organizations, though activity from the attacker’s address may have reached nearly 1,000 tenants. The intrusion utilized a client assertion credential residing within the vendor’s own tenant, which allowed attackers to effectively bypass multi-factor authentication (MFA) by exploiting a trusted application identity rather than individual user accounts. In response, ConnectWise has suspended several cloud services, including Cloud Backup, SaaS Security, and Cloud Management, to implement mitigations. This suspension impacts scheduled backups, archive access, restores, and license management. While ConnectWise stated there is currently no evidence that stored backups were accessed, the service halt means customers are temporarily unable to perform data restorations. ConnectWise has revoked the compromised certificates and cancelled the affected credentials. The company has engaged a third-party incident response firm to assist in the investigation and has shared relevant IP addresses and guidance to help managed service providers (MSPs) review their Microsoft 365 environments. Recent developments indicate the scale of the breach may be significantly larger than initially reported. Microsoft security researchers have identified that state-sponsored hackers from China targeted approximately 2,250 organizations. The attackers reportedly utilized AI agents to automate access attempts at a rate of nearly 3,000 connections per minute, a high cadence intended to saturate security team reaction times and bypass traditional detection.

Entities

Microsoft · ConnectWise · Huntress · SkyKick · Microsoft 365

Claims

What the coverage asserts, and how many sources carry each claim.

[● 6 SOURCES] Security firm Huntress confirmed unauthorized sign-ins in at least 162 to 173 Microsoft 365 tenants.
[● 2 SOURCES] Huntress later identified nearly 1,000 tenants showing activity from the attacker’s address.
[● 2 SOURCES] Microsoft identified the incident as a supply chain attack involving the compromise of a trusted OAuth application.
[● 2 SOURCES] ConnectWise stated there is no evidence that stored backups were accessed during the breach.
[● 2 SOURCES] The attackers used the stolen credential to bypass multi-factor authentication (MFA) by signing in as an application rather than a user.
[○ 1 SOURCE] ConnectWise suspended its Cloud Backup service and took SaaS Security and Cloud Management offline to mitigate the incident.
[○ 1 SOURCE] Attackers added credentials for the service principal to compromised environments to maintain persistent access.
[○ 1 SOURCE] The company has engaged a third-party incident response firm to assist with the investigation.

Timeline

4 days ago

[TECHNOLOGY] 3 sources
Chinese hackers target thousands of companies via ConnectWise breach
Chinese state-sponsored hackers used AI to automate a massive breach of ConnectWise cloud services, targeting 2,250 organizations by stealing credentials to access Microsoft environments.
7 days ago

[TECHNOLOGY] 5 sources
ConnectWise suspends cloud services following Microsoft 365 cyberattack
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after a cyberattack exploited application identities to access at least 162 Microsoft 365 tenants.
10 days ago

[TECHNOLOGY] 10 sources
ConnectWise suspends Cloud Backup service after Microsoft 365 credential breach
ConnectWise suspended its Cloud Backup service after a supply chain attack used stolen application credentials to access hundreds of Microsoft 365 tenants, bypassing MFA via OAuth exploitation.

Sources

allotech-dz.com · blogspan.net · cnbce.com · cybernoz.com · cybersecuritydive.com · dijitaliyidir.com · drweb.de · hubsite365.com · it-boltwise.de · itnews.com.au · kulturegeek.fr · security.nl · securityaffairs.co · sempreupdate.com.br · servicesmobiles.fr · softzone.es · thanhnien.vn · thehackernews.com · time.news

This summary has been updated 3 times: see revision history